Today it kicks in: on Pro, Max, and Team plans, Claude Code now starts new sessions in auto mode by default. If you used to dismiss an approval dialog on every tool call, that’s gone. Instead, each action runs through a classifier that only steps in when something is irreversible, destructive, or aimed outside your environment.
Why Anthropic is making the change
The numbers in the blog post are the real story. 97% of all permission prompts get approved. That sounds like control, but it’s the opposite: click “yes” a hundred times a day and you stop reading. When Claude presents a plan, users reject 39% of them – for individual permissions, only 3%. Clicking approve has become a habit, not a review.
Then there’s a test that sticks with you. Anthropic put 1,053 paid testers into a coding session and slipped a clearly dangerous command into the middle. The humans stopped it 13.6% of the time. Auto mode, 89%. And the longer the session ran, the worse the humans got – the classifier stayed flat.
What auto mode actually does
It replaces the prompts with a check on every tool call. When the classifier blocks something, Claude usually finds a safer path on its own or asks you directly. If it can’t make progress – three blocks in a row, or twenty across a session – Claude Code falls back to manual approvals.
Data exfiltration is a hard line: sending code or secrets outside is never auto-approved. Before a git push, the classifier even checks whether the destination is public or private. And content from web pages or tool results gets scanned for hidden instructions before it reaches Claude’s context.
Internally at Anthropic, auto mode prevented three real incidents: a report that would have landed on a public code-sharing site after a failed upload, a mass process kill that would have torn down hundreds of GPUs running training jobs, and a role with full admin access when only read-only billing access was requested.
My take
This is a turning point, even if it arrives quietly. Anthropic is shifting the default stance from “ask about everything” to “keep going unless something’s on fire.” And the data backs them up: teams using auto mode ship about 25% more PRs. Adobe, Nuro, Gusto, and Garner Health already run it as their production default.
Still, there’s a slight unease, and that’s healthy. A classifier isn’t a guarantee – Anthropic says so itself, it doesn’t drop the risk to zero. For critical changes to production infrastructure, you should still look yourself. You can switch with Shift+Tab, and Enterprise admins can turn the mode off entirely via disableAutoMode. For everyday work, though, I’ll happily take auto mode – fewer clicks, more focus, and apparently the safer path too.
Sources: